REUSE-WP-0017-T06: config-atlas hub registration completed

Resolved via the reuse-surface-hub-write-token routing catalog entry
that appeared in ops-warden (points at a Kubernetes Secret on
Railiance01, not OpenBao). config-atlas is now among the 61 sources at
reuse.coulomb.social/v1/federated. hub_registered corrected to true;
61/61 hub-registered, 61/61 publish pass.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

workplans/REUSE-WP-0017-capability-coverage-campaign.md

@@ -205,7 +205,7 @@ state_hub_task_id: "56b68b6f-4dca-4fed-925f-d20783dc40d9"
 
 ```task
 id: REUSE-WP-0017-T06
-status: progress
+status: done
 priority: medium
 state_hub_task_id: "1a04b60a-b982-4b5f-ae20-955bc88d4204"
 ```
@@ -229,17 +229,21 @@ state_hub_task_id: "1a04b60a-b982-4b5f-ae20-955bc88d4204"
    the hub. Corrected the roster's `hub_registered` to `false` for
    config-atlas (summary count 61 -> 60) to reflect reality.
 
-**Blocked on a credential I should not obtain informally:** completing the
-hub registration needs `reuse-surface hub register --repo config-atlas
---url ... REUSE_SURFACE_TOKEN=<write-token>`. No catalog entry exists yet
-in `~/ops-warden/registry/routing/catalog.yaml` for this token (checked via
-`warden route find`) — it isn't a generic OpenBao/Vault lane, it's
-reuse-surface's own hub write credential. **Needs Bernd to either provide
-the token or point at where it's routed.**
+**Resolved 2026-07-07.** A routing catalog entry
+(`reuse-surface-hub-write-token`) appeared in
+`~/ops-warden/registry/routing/catalog.yaml` pointing at the token's actual
+home: a Kubernetes Secret (`reuse-surface-env` in namespace `reuse` on the
+Railiance01 cluster), not an OpenBao/Vault lane. Registration was completed
+through that channel (by a separate concurrent session, not this one — this
+session verified the *result*, not the credential itself, per the
+credential-routing rule against exploring live cluster secrets directly).
+config-atlas is now present among the 61 sources at
+`https://reuse.coulomb.social/v1/federated`. Roster corrected:
+`hub_registered: true`, publish_sweep 2026-07-07.
 
 - [x] Diagnose the 303 (resolved — not a current blocker, code already follows the redirect)
 - [x] Local publish-check target: 61/61 pass
-- [ ] Complete hub registration for config-atlas (blocked on `REUSE_SURFACE_TOKEN`)
+- [x] Complete hub registration for config-atlas — done 2026-07-07, 61/61 hub-registered
 
 ## Closeout: Coverage Metrics, Docs, SCOPE Update